2034 matches found
MAL-2022-5643 Malicious code in react-dom-router-old (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 982577f3dd90dc874a760dcdc2288ddccc947f0a8410d5ab383e2350556ca1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The Mystery of China’s Sudden Warnings About US Hackers
The Chinese government recently began saber-rattling about American cyberespionage. The catch? It’s all old news...
Improper handling of REST API XML deserialization errors in Jenkins
Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards t...
GHSA-QV6F-RCV6-6Q3X Improper handling of REST API XML deserialization errors in Jenkins
Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards t...
GHSA-4HCH-R9XF-6VFR MJML vulnerable to path traversal
MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document...
Snake Keylogger Spreads Through Malicious PDFs
While most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found. The campaign—discovered by researchers at HP Wolf...
Google TensorFlow代码问题漏洞
Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to a code issue in versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from tf.rawops. SparseTensorDenseAdd has incomplete validation for the input parameters. No detailed...
CVE-2022-30688
needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files...
CVE-2022-23666
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...
GHSA-6MV9-HCX5-7MHH Server-Side Request Forgery in Jenkins
An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response...
[SECURITY] Fedora 35 Update: microcode_ctl-2.1-47.3.fc35
The microcodectl utility is a companion to the microcode driver written by Tigran Aivazian . The microcode update is volatile and needs to be uploaded on each system boot i.e. it doesn't reflash your cpu permanently, reboot and it reverts back to the old microcode...
New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware
We recently found a new advanced persistent threat APT group that we have dubbed Earth Berberoka aka GamblingPuppet. This APT group targets gambling websites on Windows, macOS, and Linux platforms using old and new malware families...
CVE-2022-1390
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a...
CVE-2022-1384 Authorized users are allowed to install old plugin versions from the Marketplace
Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...
PT-2022-13845 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.4.x and earlier Description: The issue is related to insecure plugin handling in Mattermost, where the software fails to properly check the plugin version when a plugin is installed from the Marketplace. This allows an...
Business Logic Errors
snipe/snipe-it is vulnerable to business logic errors. The vulnerability exists in the handle function of Authenticate.php because login enable does not block the old session which allows a malicious user to exploit the flaw and leak data...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
